Is CVE-2026-92809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92809 being exploited in the wild.

How severe is CVE-2026-92809?

Medium severity, with a CVSS score of 4.3, published 16 September 2026.

Which products and versions are affected?

PrestaShop Psgdpr through 1.4.3.

Is there a fix for CVE-2026-92809?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92809 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92809?

Check whether you run PrestaShop Psgdpr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92809: PrestaShop psgdpr insufficient validation in GDPR consent logging

CVE-2026-92809 · Severity: medium · CVSS 4.3 · Published 2026-09-16

PrestaShop's psgdpr module is a GDPR compliance extension for e-commerce sites that tracks customer consent to data processing. Authenticated attackers can forge consent records for arbitrary other customers by manipulating request parameters, corrupting audit logs and potentially masking non-compliance or framing customers for unwanted consent grants.

Vendors: PrestaShop.

Quick answers

Is CVE-2026-92809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92809 being exploited in the wild.
How severe is CVE-2026-92809?: Medium severity, with a CVSS score of 4.3, published 16 September 2026.
Which products and versions are affected?: PrestaShop Psgdpr through 1.4.3.
Is there a fix for CVE-2026-92809?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92809 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92809?: Check whether you run PrestaShop Psgdpr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient authorization check in the FrontAjaxGdpr controller. While the code validates a customer_token or guest_token to ensure the request is authentic, it does not verify that the id_customer parameter matches the authenticated user before logging consent. An attacker can submit an arbitrary customer ID in the request payload, and if the token validation passes for their own session, the GDPRLog::addLog() call will create a forged consent entry attributed to any customer ID they specify. The attack requires authentication but allows an attacker to corrupt the consent audit trail for other users.

Affected products

PrestaShop psgdpr through 1.4.3

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.